Malware Analysis Report

2024-09-11 08:38

Sample ID 240610-y627yazbkr
Target 2cd8acc152ab6e5eb5a697f193ac42180dc9da867349724cb49f348f3ed403c0
SHA256 2cd8acc152ab6e5eb5a697f193ac42180dc9da867349724cb49f348f3ed403c0
Tags
neconyd trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2cd8acc152ab6e5eb5a697f193ac42180dc9da867349724cb49f348f3ed403c0

Threat Level: Known bad

The file 2cd8acc152ab6e5eb5a697f193ac42180dc9da867349724cb49f348f3ed403c0 was found to be: Known bad.

Malicious Activity Summary

neconyd trojan

Neconyd family

Neconyd

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-10 20:24

Signatures

Neconyd family

neconyd

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-10 20:24

Reported

2024-06-10 20:27

Platform

win7-20240220-en

Max time kernel

145s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2cd8acc152ab6e5eb5a697f193ac42180dc9da867349724cb49f348f3ed403c0.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2cd8acc152ab6e5eb5a697f193ac42180dc9da867349724cb49f348f3ed403c0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2cd8acc152ab6e5eb5a697f193ac42180dc9da867349724cb49f348f3ed403c0.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1992 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\2cd8acc152ab6e5eb5a697f193ac42180dc9da867349724cb49f348f3ed403c0.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1992 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\2cd8acc152ab6e5eb5a697f193ac42180dc9da867349724cb49f348f3ed403c0.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1992 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\2cd8acc152ab6e5eb5a697f193ac42180dc9da867349724cb49f348f3ed403c0.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1992 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\2cd8acc152ab6e5eb5a697f193ac42180dc9da867349724cb49f348f3ed403c0.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 2868 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2868 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2868 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 2868 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 1536 wrote to memory of 2188 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1536 wrote to memory of 2188 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1536 wrote to memory of 2188 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 1536 wrote to memory of 2188 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2cd8acc152ab6e5eb5a697f193ac42180dc9da867349724cb49f348f3ed403c0.exe

"C:\Users\Admin\AppData\Local\Temp\2cd8acc152ab6e5eb5a697f193ac42180dc9da867349724cb49f348f3ed403c0.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp

Files

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 7e44c432e6e7b468b2562785bcc77cb1
SHA1 e81c5f165b2928e9432299a061be7268d8076211
SHA256 4a6e039291c0873fe5e3ab988e8cd27c1d06c439301215d6df943e43de3014a2
SHA512 7ea70200d71fb4d875c9776791f728cef57dd738999af95331b52880bcb000c9e0493667f175c84fede768afb1ef5765ff2ceed0080eb3ca9c7e9ea90e86dfc2

\Windows\SysWOW64\omsecor.exe

MD5 49923b004d366268a788125b812d01a9
SHA1 79ac33f602b3e1113ff3a647dda4c2f35b0a74e0
SHA256 a6042c88bdcf90cdf2b9103e2bd390eaeca0a69aad567358f2dd576665f8273e
SHA512 edb44f13133d4706ed7607b7ce0e51fbce9328e6c2b85426ee60caa19b1efbd942664825517af5a7c7652d18296764f131dd68180e14d153208b314eefad6861

\Users\Admin\AppData\Roaming\omsecor.exe

MD5 801c1ce4604f5491d23685601af4d1e8
SHA1 bffbf945614010555b953e6f907270b6463cf2df
SHA256 60d29f16b6d0f8953dac327ca8299e5b20247fa1555fd265cc06031ace127643
SHA512 0f2937001db1ed595b7a050b9e0cfd2195862d3122aad3fc8d751438ae380d263df5b9332ab1b5cb6ef7878b193df5de29a02bae216c5ca4a87c7b958ad814cb

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-10 20:24

Reported

2024-06-10 20:27

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2cd8acc152ab6e5eb5a697f193ac42180dc9da867349724cb49f348f3ed403c0.exe"

Signatures

Neconyd

trojan neconyd

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A
N/A N/A C:\Windows\SysWOW64\omsecor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4892 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\2cd8acc152ab6e5eb5a697f193ac42180dc9da867349724cb49f348f3ed403c0.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4892 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\2cd8acc152ab6e5eb5a697f193ac42180dc9da867349724cb49f348f3ed403c0.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4892 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\2cd8acc152ab6e5eb5a697f193ac42180dc9da867349724cb49f348f3ed403c0.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4532 wrote to memory of 4728 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4532 wrote to memory of 4728 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4532 wrote to memory of 4728 N/A C:\Users\Admin\AppData\Roaming\omsecor.exe C:\Windows\SysWOW64\omsecor.exe
PID 4728 wrote to memory of 4424 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4728 wrote to memory of 4424 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe
PID 4728 wrote to memory of 4424 N/A C:\Windows\SysWOW64\omsecor.exe C:\Users\Admin\AppData\Roaming\omsecor.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2cd8acc152ab6e5eb5a697f193ac42180dc9da867349724cb49f348f3ed403c0.exe

"C:\Users\Admin\AppData\Local\Temp\2cd8acc152ab6e5eb5a697f193ac42180dc9da867349724cb49f348f3ed403c0.exe"

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\omsecor.exe

C:\Windows\System32\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

C:\Users\Admin\AppData\Roaming\omsecor.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 lousta.net udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 145.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 mkkuei4kdsz.com udp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 73.91.225.64.in-addr.arpa udp
US 8.8.8.8:53 ow5dirasuek.com udp
US 52.34.198.229:80 ow5dirasuek.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
FI 193.166.255.171:80 lousta.net tcp
FI 193.166.255.171:80 lousta.net tcp
US 64.225.91.73:80 mkkuei4kdsz.com tcp
US 8.8.8.8:53 udp

Files

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 7e44c432e6e7b468b2562785bcc77cb1
SHA1 e81c5f165b2928e9432299a061be7268d8076211
SHA256 4a6e039291c0873fe5e3ab988e8cd27c1d06c439301215d6df943e43de3014a2
SHA512 7ea70200d71fb4d875c9776791f728cef57dd738999af95331b52880bcb000c9e0493667f175c84fede768afb1ef5765ff2ceed0080eb3ca9c7e9ea90e86dfc2

C:\Windows\SysWOW64\omsecor.exe

MD5 78186e7552ba4370b928aeb9a5f06417
SHA1 bcc70955c7b8496f7d104b89918aaac1ca1fed1a
SHA256 6308c14684743bee04e90cfafe08c9cd0001eee3ce2df4141f10058d2074d5f5
SHA512 c2fd83063f0f19aaf95c4a0c7123ee02e01024a8ee2d51f5d18b145eb829fba4b68680a2c5ff6fb6c442fef3283b98d1576c325eb1067069bf790d1d5cad508c

C:\Users\Admin\AppData\Roaming\omsecor.exe

MD5 c009f1971c582fb3e4646ae6be725ad4
SHA1 5033087620e274416555bb1e911682f6002a454c
SHA256 af56e06764ce9cc62ded331a2c7c650d821bd1ba1ec4e2d966f403efd6a5ac2e
SHA512 bd7166f7f7485e67fe0e89cc7bbfb2ea7e31f2908c3a43e335b549f44105945b9aeea5009c5d40f70afe3357a5ccfb0b6bb8c73b462f43e8733beffed5e4be8b